Data Processing Agreement

This Data Processing Agreement ("DPA") is entered into between:

The Processor: SSIT, MB (legal form: mažoji bendrija; company registration number: 306676561; registered address: Blindžių g. 24-5, LT-08110 Vilnius, Lithuania), the operator of the Talentika platform ("Processor").

The Controller: the legal entity that has accepted Talentika's Terms of Service and uses the Service to process personal data ("Controller").

This DPA forms an integral part of the Terms of Service. It is accepted electronically when the Controller accepts the Terms of Service or upon first use of the Service. The version of this DPA in force is the version published at talentika.lt/dpa at the time of acceptance. The Controller may request a countersigned copy by contacting info@talentika.lt.

Data subjects:

• Job candidates who apply through the Controller's career pages or whose data the Controller imports into the Service.
• The Controller's employees and authorised users (recruiters, hiring managers, administrators).
• Visitors to the Controller's career pages.

Categories of personal data:

• Candidate data: name, email address, phone number, CV/résumé, cover letter, application form responses, interview schedules, recruiter notes and ratings, tags, GDPR consent records, and uploaded files.
• User data: name, email address, role, activity logs, and notification preferences.
• Career page visitor data: IP addresses, browser information, page views (anonymised where feasible).

Special categories of data: the Service is not designed to process special categories of personal data (Article 9 GDPR). The Controller agrees not to upload or process such data through the Service unless it has confirmed in writing with the Processor that appropriate additional safeguards are in place.

The Processor shall:

• (a) Process on instructions: Process Personal Data only on documented instructions from the Controller, including with regard to transfers of Personal Data to third countries, unless required to do so by EU or Member State law. In such a case, the Processor shall inform the Controller of the legal requirement before processing, unless the law prohibits such information.
• (b) Confidentiality: Ensure that persons authorised to process Personal Data are bound by confidentiality obligations or are under an appropriate statutory obligation of confidentiality.
• (c) Security measures: Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR. The current measures are described in Section 12 of this DPA.
• (d) Sub-processors: Engage sub-processors only in accordance with Section 9 of this DPA.
• (e) Assistance with data subject rights: Taking into account the nature of the processing, assist the Controller by appropriate technical and organisational measures, insofar as possible, in fulfilling its obligation to respond to requests from data subjects exercising their rights under Articles 15-22 GDPR. The Service includes built-in features (data export, account deletion, candidate data deletion) to facilitate such requests.
• (f) Assistance with controller obligations: Assist the Controller in ensuring compliance with Articles 32-36 GDPR (security, breach notification, data protection impact assessments, prior consultation), taking into account the nature of processing and the information available to the Processor.
• (g) Return or deletion of data: At the choice of the Controller, delete or return all Personal Data to the Controller after the end of the provision of services and delete existing copies, unless EU or Member State law requires storage. Upon request, the Processor shall provide written confirmation of deletion.
• (h) Demonstrate compliance: Make available to the Controller all information necessary to demonstrate compliance with the obligations under Article 28 GDPR, and allow for and contribute to audits as set out in Section 13.

The Processor shall notify the Controller without undue delay and within 48 hours of becoming aware of a Personal Data Breach. The notification shall include, to the extent known:

• (a) The nature of the breach, including the categories and approximate number of data subjects and Personal Data records concerned;
• (b) The name and contact details of a contact point at the Processor where more information can be obtained;
• (c) The likely consequences of the breach;
• (d) The measures taken or proposed to be taken to address the breach and mitigate its possible adverse effects;
• (e) The time at which the Processor became aware of the breach.

If not all information is available within 48 hours, the Processor shall provide it in phases without further undue delay.

The Controller authorises the Processor to engage the following sub-processors as of the date of this DPA. A current list is available at talentika.lt/dpa#sub-processors.

The Processor implements the following technical and organisational measures:

• Encryption: TLS 1.2+ for data in transit; AES-256 for data at rest.
• Access control: Role-based access control with company-level data isolation (multi-tenant architecture).
• Audit logging: All sensitive actions (data access, modifications, deletions) are logged.
• Rate limiting: Applied to prevent abuse and brute-force attacks.
• Security headers: Content Security Policy (CSP), HTTP Strict Transport Security (HSTS), X-Frame-Options.
• Input validation: Sanitisation and validation to prevent injection attacks.
• Soft delete with retention windows: Configurable candidate data retention periods; file deletions use a 14-day grace period before permanent removal.
• Backups: Regular automated backups with point-in-time recovery.
• Personnel security: Confidentiality obligations and access on a need-to-know basis.
• Vulnerability management: Regular dependency updates and security review of changes.

The Processor may update these measures from time to time, provided the level of security is not reduced.